Microsoft Security Update Guide · Copilot
Microsoft 365 Copilot for Android Spoofing Vulnerability
Published · updated 9 jun 2026
What does this mean?
- Spoofing. An attacker can pretend to be another user or source, for example through a misleading link or page.
- It can be exploited with access to the device itself, with an ordinary user account and without any user action.
- CVSS 4.4 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft OneNote for Android: KBRelease Notes
16.0.19822.20190 - Microsoft Loop for Android: KBRelease Notes
16.0.19822.20190 - Microsoft PowerPoint for Android: KBRelease Notes
16.0.19822.20190 - Microsoft Word for Android: KBRelease Notes
16.0.19822.20190 - Microsoft Excel for Android: KBRelease Notes
16.0.19822.20190 - Microsoft 365 Copilot for Android: KBRelease Notes
16.0.19822.20190
- Microsoft OneNote for Android: KBRelease Notes
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
How do I check if I am affected?
Update the app
- Update the app through the App Store, Google Play or the app's own automatic updates.
- If you manage devices with Intune, check in the Intune admin center which devices still run an older version.
What kind of flaw is this?
- CWE-284: Improper Access Control
Access to a function or data is not properly restricted.
Key facts
Released
12 mei 2026
Last revised
9 jun 2026 (v2)
Impact
Spoofing
Max severity
Important
Weakness
CVSS 3.1
4.4 / 3.9 (base / temporal)
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:CPublicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Unlikely
Customer action required
Yes
Links
CVSS metrics
| Base score metrics | |
|---|---|
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity | Low |
| Availability | None |
| Temporal score metrics | |
| Exploit Code Maturity | Unproven |
| Remediation Level | Official Fix |
| Report Confidence | Confirmed |
Affected products and updates
| Product | Update | Build |
|---|---|---|
| Microsoft OneNote for Android | KBRelease Notes · Security Update | 16.0.19822.20190 |
| Microsoft Loop for Android | KBRelease Notes · Security Update | 16.0.19822.20190 |
| Microsoft PowerPoint for Android | KBRelease Notes · Security Update | 16.0.19822.20190 |
| Microsoft Word for Android | KBRelease Notes · Security Update | 16.0.19822.20190 |
| Microsoft Excel for Android | KBRelease Notes · Security Update | 16.0.19822.20190 |
| Microsoft 365 Copilot for Android | KBRelease Notes · Security Update | 16.0.19822.20190 |
FAQ
- According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), and integrity (I:L) but lead to no loss of availability (A:N). What is the impact of this vulnerability?
- An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality), make changes to disclosed information (Integrity), but cannot limit access to the resource (Availability).
Revisions
| Version | Date | Note |
|---|---|---|
| 2 | 9 jun 2026 | Added Microsoft Excel for Android, Microsoft Word for Android, Microsoft Loop for Android, Microsoft PowerPoint for Android and Microsoft OneNote for Android softwares to the Security Updates table. Customers that are running supported version of these products are encouraged to update to the indicated versions to be protected from this vulnerability. |
| 1 | 12 mei 2026 | Information published. |
What changed in Microsoft 365 this week? →
View at Microsoft → ← All security advisories
Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.
